From 9dac24287e72fb0005da47faeee6d687b49b9efb Mon Sep 17 00:00:00 2001 From: Benjamin Bohard Date: Mon, 2 Sep 2019 17:32:04 +0200 Subject: [PATCH] Update apache configuration templates --- dicos/70_lemonldap_ng.xml | 6 +- posttemplate/70-lemon-nginx | 6 +- tmpl/handler-apache2.4.conf | 52 +++++++++++++++++ tmpl/manager-apache2.4.conf | 102 ++++++++++++++++++++++++++++++++ tmpl/portal-apache2.4.conf | 112 ++++++++++++++++++++++++++++++++++++ tmpl/test-apache2.4.conf | 47 +++++++++++++++ 6 files changed, 319 insertions(+), 6 deletions(-) create mode 100644 tmpl/handler-apache2.4.conf create mode 100644 tmpl/manager-apache2.4.conf create mode 100644 tmpl/portal-apache2.4.conf create mode 100644 tmpl/test-apache2.4.conf diff --git a/dicos/70_lemonldap_ng.xml b/dicos/70_lemonldap_ng.xml index 6aaf053..189f16d 100644 --- a/dicos/70_lemonldap_ng.xml +++ b/dicos/70_lemonldap_ng.xml @@ -5,9 +5,9 @@ - - - + + + diff --git a/posttemplate/70-lemon-nginx b/posttemplate/70-lemon-nginx index bc28e6f..690ee87 100755 --- a/posttemplate/70-lemon-nginx +++ b/posttemplate/70-lemon-nginx @@ -16,14 +16,14 @@ do if [ -L /etc/nginx/sites-enabled/${SERVICE}-nginx.conf ];then rm /etc/nginx/sites-enabled/${SERVICE}-nginx.conf fi - if [ -L /etc/apache2/sites-enabled/${SERVICE}-apache2.conf ];then - a2dissite ${SERVICE}-apache2 + if [ -L /etc/apache2/sites-enabled/${SERVICE}-apache2.4.conf ];then + a2dissite ${SERVICE}-apache2.4 fi if [ "${ENABLE}" = 'oui' ];then if [ "${SERVER}" = 'nginx' ];then ln -s /etc/nginx/sites-available/${SERVICE}-nginx.conf /etc/nginx/sites-enabled/${SERVICE}-nginx.conf elif [ "${SERVER}" = 'apache2' ];then - a2ensite ${SERVICE}-apache2.conf + a2ensite ${SERVICE}-apache2.4.conf fi fi done diff --git a/tmpl/handler-apache2.4.conf b/tmpl/handler-apache2.4.conf new file mode 100644 index 0000000..50d86e1 --- /dev/null +++ b/tmpl/handler-apache2.4.conf @@ -0,0 +1,52 @@ +#======================================================================== +# Apache configuration for LemonLDAP::NG Handler +#======================================================================== +# This file implements the reload virtualhost that permits to reload +# configuration without restarting server, and some common instructions. +# You need then to declare this vhost in reloadUrls (in the manager +# interface if this server doesn't host the manager itself): +# +# KEY : VALUE +# host-or-IP:port : http://reload.example.com/reload +# +# IMPORTANT: +# To protect applications, see test-apache.conf template in example files + +# Load LemonLDAP::NG Handler +PerlOptions +GlobalRequest +PerlModule Lemonldap::NG::Handler::ApacheMP2 + +# Common error page and security parameters +ErrorDocument 403 https//%%authWebName/lmerror/403 +ErrorDocument 404 https//%%authWebName/lmerror/404 +ErrorDocument 500 https//%%authWebName/lmerror/500 +ErrorDocument 502 https//%%authWebName/lmerror/502 +ErrorDocument 503 https//%%authWebName/lmerror/503 + + + ServerName %%reloadWebName + + # Configuration reload mechanism (only 1 per physical server is + # needed): choose your URL to avoid restarting Apache when + # configuration change + + Require ip 127 ::1 + SetHandler perl-script + PerlResponseHandler Lemonldap::NG::Handler::ApacheMP2->reload + + + # Uncomment this to activate status module + # + # Require ip 127 ::1 + # SetHandler perl-script + # PerlResponseHandler Lemonldap::NG::Handler::ApacheMP2->status + # # You may have to uncomment the next directive to skip + # # an upper PerlHeaderParserHandler directive + # #PerlHeaderParserHandler Apache2::Const::DECLINED + # + + # Uncomment this if site if you use SSL only + #Header set Strict-Transport-Security "max-age=15768000" + + + diff --git a/tmpl/manager-apache2.4.conf b/tmpl/manager-apache2.4.conf new file mode 100644 index 0000000..dd0329d --- /dev/null +++ b/tmpl/manager-apache2.4.conf @@ -0,0 +1,102 @@ +#==================================================================== +# Apache configuration for LemonLDAP::NG Manager +#==================================================================== + +# To insert LLNG user id in Apache logs, declare this format and use it in +# CustomLog directive +#LogFormat "%v:%p %h %l %{Lm-Remote-User}o %t \"%r\" %>s %O" llng + +# Manager virtual host (manager.__DNSDOMAIN__) + + ServerName %%managerWebName + LogLevel notice + # See above to set LLNG user id in Apache logs + #CustomLog $(APACHE_LOG_DIR)/manager.log llng + #ErrorLog $(APACHE_LOG_DIR)/lm_err.log + SSLEngine on + SSLCertificateFile %%apache_cert + SSLCertificateKeyFile %%server_key + SSLProtocol all -SSLv3 -SSLv2 + + # Uncomment this if you are running behind a reverse proxy and want + # LemonLDAP::NG to see the real IP address of the end user + # Adjust the settings to match the IP address of your reverse proxy + # and the header containing the original IP address + # + #RemoteIPHeader X-Forwarded-For + #RemoteIPInternalProxy 127.0.0.1 + + + # FASTCGI CONFIGURATION + # --------------------- + + # 1) URI management + RewriteEngine on + + # For performances, you can delete the previous RewriteRule line after + # puttings html files: simply put the HTML results of differents modules + # (configuration, sessions, notifications) as manager.html, sessions.html, + # notifications.html and uncomment the 2 following lines: + # DirectoryIndex manager.html + # RewriteCond "%{REQUEST_FILENAME}" "!\.html$" + + # REST URLs + RewriteCond "%{REQUEST_FILENAME}" "!^/(?:static|doc|lib|javascript|favicon).*" + RewriteRule "^/(.+)$" "/manager.fcgi/$1" [PT] + + # 2) FastCGI engine + + # You can choose any FastCGI system. Here is an example using mod_fcgid + # mod_fcgid configuration + FcgidMaxRequestLen 2000000 + + SetHandler fcgid-script + Options +ExecCGI + header unset Lm-Remote-User + + + # If you want to use mod_fastcgi, replace lines below by: + #FastCgiServer /usr/share/lemonldap-ng/manager/htdocs/manager.fcgi + + # GLOBAL CONFIGURATION + # -------------------- + + DocumentRoot /usr/share/lemonldap-ng/manager/htdocs + + + Require all granted + + + AddOutputFilterByType DEFLATE text/html text/plain text/xml text/javascript text/css + SetOutputFilter DEFLATE + BrowserMatch ^Mozilla/4 gzip-only-text/html + BrowserMatch ^Mozilla/4\.0[678] no-gzip + BrowserMatch \bMSIE !no-gzip !gzip-only-text/html + SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary + + + Header append Vary User-Agent env=!dont-vary + + + + # Static files (javascripts, HTML forms,...) + + Alias /static/ /usr/share/lemonldap-ng/manager/htdocs/static/ + + Require all granted + Options +FollowSymLinks + + + # On-line documentation + Alias /doc/ /usr/share/lemonldap-ng/htdocs/doc/ + Alias /lib/ /usr/share/lemonldap-ng/htdocs/doc/pages/documentation/current/lib/ + + Require all granted + ErrorDocument 404 /notfound.html + Options +FollowSymLinks + DirectoryIndex index.html start.html + + + # Uncomment this if site if you use SSL only + #Header set Strict-Transport-Security "max-age=15768000" + diff --git a/tmpl/portal-apache2.4.conf b/tmpl/portal-apache2.4.conf new file mode 100644 index 0000000..106f81f --- /dev/null +++ b/tmpl/portal-apache2.4.conf @@ -0,0 +1,112 @@ +#==================================================================== +# Apache configuration for LemonLDAP::NG Portal +#==================================================================== + +# To insert LLNG user id in Apache logs, declare this format and use it in +# CustomLog directive +#LogFormat "%v:%p %h %l %{Lm-Remote-User}o %t \"%r\" %>s %O" llng + +# Portal Virtual Host (auth.__DNSDOMAIN__) + + ServerName auth.__DNSDOMAIN__ + # See above to set LLNG user id in Apache logs + #CustomLog $(APACHE_LOG_DIR)/portal.log llng + + # Uncomment this if you are running behind a reverse proxy and want + # LemonLDAP::NG to see the real IP address of the end user + # Adjust the settings to match the IP address of your reverse proxy + # and the header containing the original IP address + # + #RemoteIPHeader X-Forwarded-For + #RemoteIPInternalProxy 127.0.0.1 + + # DocumentRoot (FCGI scripts) + DocumentRoot /usr/share/lemonldap-ng/portal/htdocs/ + + Require all granted + Options +ExecCGI +FollowSymLinks + + RewriteEngine On + # For performances, you can put static html files: simply put the HTML + # result (example: /oauth2/checksession.html) as static file. Then + # uncomment the following line. + # RewriteCond "%{REQUEST_FILENAME}" "!\.html$" + RewriteCond "%{REQUEST_FILENAME}" "!^/(?:(?:static|javascript|favicon).*|.*\.fcgi)$" + RewriteRule "^/(.+)$" "/index.fcgi/$1" [PT] + + # Note that Content-Security-Policy header is generated by portal itself + + SetHandler fcgid-script + + # Authorization header needs to be passed when using Kerberos or OIDC + = 2.4.13> + CGIPassAuth On + + + RewriteCond %{HTTP:Authorization} ^(.*) + RewriteRule .* - [e=HTTP_AUTHORIZATION:%1] + + + Options +ExecCGI + header unset Lm-Remote-User + + + # Uncomment this if status is enabled + #FcgidInitialEnv LLNGSTATUSHOST 127.0.0.1:64321 + + # Static files + Alias /static/ /usr/share/lemonldap-ng/portal/htdocs/static/ + + Require all granted + Options +FollowSymLinks + + + + ExpiresActive On + ExpiresDefault "access plus 1 month" + + + + + DirectoryIndex index.fcgi index.html + + + # REST/SOAP functions for sessions management (disabled by default) + + Require all denied + + + # REST/SOAP functions for sessions access (disabled by default) + + Require all denied + + + # REST/SOAP functions for configuration access (disabled by default) + + Require all denied + + + # REST/SOAP functions for notification insertion (disabled by default) + + Require all denied + + + # Enabe compression + + + AddOutputFilterByType DEFLATE text/html text/plain text/xml text/javascript text/css + SetOutputFilter DEFLATE + BrowserMatch ^Mozilla/4 gzip-only-text/html + BrowserMatch ^Mozilla/4\.0[678] no-gzip + BrowserMatch \bMSIE !no-gzip !gzip-only-text/html + SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary + + + Header append Vary User-Agent env=!dont-vary + + + + # Uncomment this if site if you use SSL only + #Header set Strict-Transport-Security "max-age=15768000" + + diff --git a/tmpl/test-apache2.4.conf b/tmpl/test-apache2.4.conf new file mode 100644 index 0000000..d69f131 --- /dev/null +++ b/tmpl/test-apache2.4.conf @@ -0,0 +1,47 @@ +#==================================================================== +# Apache configuration for LemonLDAP::NG sample applications +#==================================================================== + +PerlModule Lemonldap::NG::Handler::ApacheMP2::Menu + +# Sample application + + ServerName test1.__DNSDOMAIN__ + ServerAlias test2.__DNSDOMAIN__ + + # Uncomment this if you are running behind a reverse proxy and want + # LemonLDAP::NG to see the real IP address of the end user + # Adjust the settings to match the IP address of your reverse proxy + # and the header containing the original IP address + # + #RemoteIPHeader X-Forwarded-For + #RemoteIPInternalProxy 127.0.0.1 + + # SSO protection + PerlHeaderParserHandler Lemonldap::NG::Handler::ApacheMP2 + + # DocumentRoot + DocumentRoot __TESTDIR__ + + Require all granted + Options +ExecCGI + + + # Perl script (application test is written in Perl) + + SetHandler perl-script + PerlResponseHandler ModPerl::Registry + + # Display Menu + PerlOutputFilterHandler Lemonldap::NG::Handler::ApacheMP2::Menu->run + + + + # Directory index + + DirectoryIndex index.pl index.html + + + # Uncomment this if site if you use SSL only + #Header set Strict-Transport-Security "max-age=15768000" +